EUVD-2026-84039

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the POST /api/machine/pk/restart/ endpoint in src/backend/InvenTree/machine/api.py uses IsAuthenticatedOrReadScope without requiring the ADMIN role used by other machine management operations. Any authenticated user who lack...

CVE-2026-61745 InvenTree: Missing authorization on machine restart endpoint allows any authenticated user to interrupt production equipment

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the POST /api/machine/pk/restart/ endpoint in src/backend/InvenTree/machine/api.py uses IsAuthenticatedOrReadScope without requiring the ADMIN role used by other machine management operations. Any authenticated user who lack...

PT-2026-96200

Name of the Vulnerable Software and Affected Versions InvenTree versions prior to 1.4.0 Description The POST '/api/machine/pk/restart/' endpoint in src/backend/InvenTree/machine/api.py uses IsAuthenticatedOrReadScope without requiring the ADMIN role. This allows any authenticated user, such as...

CVE-2026-61745: Missing Authorization

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the POST /api/machine/pk/restart/ endpoint in src/backend/InvenTree/machine/api.py uses IsAuthenticatedOrReadScope without requiring the ADMIN role used by other machine management operations. Any authenticated user who lack...

NextRecon

NextRecon NextRecon is a simple Python-based reconnaissance tool designed for bug bounty hunters, security researchers, and penetration testers. It performs passive recon by collecting archived URLs from the Wayback Machine and fetching leaked credentials from the BreachCollection API. It also...

machine-web (>=0.0.1, <=0.0.2.post2) potentially affected by CVE-2026-63374 via anyio (3.3.2)

anyio PYPI version 3.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - machine-web =0.0.1, =0.0.2.post2 Source cves: CVE-2026-63374 Source advisory: OSV:GHSA-82R6-8W77-94W6...

machine-web (>=0.0.1, <=0.0.2.post2) potentially affected by CVE-2026-64847 via anyio (3.3.2)

anyio PYPI version 3.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - machine-web =0.0.1, =0.0.2.post2 Source cves: CVE-2026-64847 Source advisory: OSV:GHSA-5P39-CFHJ-2XMP...

EUVD-2026-82587

Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose information over a network...

CVE-2026-68791

Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose information over a network...

CVE-2026-68791

CVE-2026-68791 is an incorrect authorization vulnerability in Azure Machine Learning that allows an unauthenticated, network-based attacker to disclose information with HIGH severity (CVSS 3.1: 8.6). The attack requires no prior privileges or user interaction, and the scope is CHANGED , indicatin...

CVE-2026-92993 Dromara mayfly-go Machine Script Feature machine_script.go RunMachineScript os command injection

A vulnerability was detected in Dromara mayfly-go up to 1.11.5. The impacted element is the function RunMachineScript of the file server/internal/machine/api/machinescript.go of the component Machine Script Feature. The manipulation of the argument params results in os command injection. The atta...

SUSE CVE-2026-89920

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix memory corruption by not reinjecting CK machine checks Channel-subsystem damage machine checks are for the host channel subsystem. The guest channel subsystem is emulated in the userspace VMM. There is no point in...

CVE-2026-90067

CVE-2026-90067 is a Linux kernel vulnerability in the Ceph messenger v2 protocol implementation (net/ceph/messenger_v2.c). When parsing the msgr2 protocol banner, a client sending a payload_len of 0 causes the kernel to set up a 0-length socket read , violating a state-machine invariant and trigg...

Azure Machine Learning Information Disclosure Vulnerability

Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose information over a network...

PT-2026-95075

Name of the Vulnerable Software and Affected Versions mayfly-go versions prior to 1.11.6 Description An OS command injection flaw exists in the Machine Script Feature within the RunMachineScript function located in the server/internal/machine/api/machine script.go file. A remote attacker with...

PT-2026-95166

Name of the Vulnerable Software and Affected Versions Azure Machine Learning affected versions not specified Description Incorrect authorization allows an unauthorized attacker to disclose information over a network. Recommendations At the moment, there is no information about a newer version tha...

CVE-2026-68791: Incorrect Authorization

Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose information over a network...

CVE-2026-92993: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was detected in Dromara mayfly-go up to 1.11.5. The impacted element is the function RunMachineScript of the file server/internal/machine/api/machinescript.go of the component Machine Script Feature. The manipulation of the argument params results in os command injection. The atta...

PT-2026-94415

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the libceph component when parsing the Ceph messenger v2 protocol banner. The payload len field is decoded from the banner prefix; if a client provides a payload len o...

AZL-101664 CVE-2026-89920 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix memory corruption by not reinjecting CK machine checks Channel-subsystem damage machine checks are for the host channel subsystem. The guest channel subsystem is emulated in the userspace VMM. There is no point in...